JUst in time access for domain admin access

Hi SAGA

It is the Privileged Access Management (PAM) with Time-to-Live (TTL) attributes feature that was introduced in Windows Server 2016 Active Directory. It’s basically Microsoft’s way of giving “just-in-time” admin rights without leaving permanent elevated accounts hanging around. Instead of making someone a Domain Admin forever, you grant them the role with a TTL value, and once that timer expires, the attribute automatically clears and the elevated access is revoked. Super handy for reducing attack surface and meeting compliance requirements.

Pre-requisites you’ll need:

• Your AD forest has to be at Windows Server 2016 functional level (both domain and forest).
• You’ll need to set up a Privileged Access Management (PAM) environment, which usually involves a bastion forest (sometimes called a “shadow forest”) to manage these temporary privileges.
• Proper replication and trust between your production forest and the PAM/bastion forest.

Implementation process at a high level:

• Create the bastion forest and establish a one-way trust with your production forest.
• Configure shadow principals (basically mirrored accounts/groups) in the bastion forest that map to your privileged groups in the production forest.
• Use PowerShell or the PAM APIs to grant membership with a TTL. For example, you can run something like Add-ADGroupMember -Member <user> -Identity "Domain Admins" -MemberTimeToLive (New-TimeSpan -Minutes 30) to give someone Domain Admin rights for 30 minutes.
• Once the TTL expires, AD automatically removes the user from the group no manual cleanup needed.

If this guidance proves helpful, feel free to click “Accept Answer” so we know we’re heading in the right direction and let me know if you need any assistance. Thank you!

The feature being described is Microsoft’s just-in-time (JIT) privileged access, implemented for on-premises Active Directory through Privileged Access Management (PAM) in Microsoft Identity Manager (MIM), and conceptually related to Just Enough Administration (JEA).

In this model:

• Privileged access (for example, Domain Admin–equivalent rights) is granted only just-in-time and for a limited duration.
• After the approved time window expires, the user is automatically removed from the privileged group, effectively revoking Domain Admin–level access.
• This is implemented via a bastion forest and temporary group membership, not permanent standing membership.

Key points from the PAM/JIT model:

1. JIT and JEA principles
   • PAM builds on just-in-time administration and Just Enough Administration (JEA).
   • JEA defines a constrained PowerShell endpoint and command set for privileged tasks.
   • An eligible user enables the needed permission for a specific task; the permission automatically expires after a specified time so that an attacker cannot reuse it.
2. How PAM is set up for JIT privileged access
   PAM setup and operation follow four steps:
   • Prepare: Identify highly privileged groups (for example, Domain Admins) in the existing forest and recreate corresponding groups without members in a bastion forest.
   • Protect: Configure lifecycle and authentication protection (for example, MFA) for JIT requests.
   • Operate: When a request is approved and authentication requirements are met, a user account is temporarily added to a privileged group in the bastion forest for a pre-set amount of time. During that window, the account has all privileges assigned to that group (including Domain Admin–level access if that is what the group represents). After the time expires, the account is automatically removed from the group.
   • Monitor: PAM provides auditing, alerts, and reports of privileged access requests and activities, helping detect unauthorized or “inside” attacks such as direct additions to privileged groups in the original forest.
3. Behavior from the admin’s perspective
   • An admin requests elevation (for example, to a group that confers Domain Admin–equivalent rights).
   • PAM/MIM approves based on policy, adds the admin to the privileged group with a time-bound membership.
   • The membership is effectively governed by a TTL-like concept: once the configured duration elapses, the system removes the membership automatically, so there is no standing Domain Admin access.
4. Why this is used
   • Aligns with the “avoid standing access” principle: no permanent Domain Admin membership.
   • Reduces risk from credential theft and malicious insiders, because elevated rights are available only for short, audited windows.

For Azure and Microsoft Entra ID, the same principle is implemented via Microsoft Entra Privileged Identity Management (PIM), which provides JIT role activation with automatic expiration, MFA, approval workflows, and auditing. For on-premises AD, the corresponding concept is MIM PAM with JIT group membership.

References:

• Privileged Access Management for Active Directory Domain Services.
• Privileged Access Management for Active Directory Domain Services
• Security Control v3: Privileged access
• Privileged Access
• Identity and access management overview
• Identity and access management with Azure Arc-enabled servers
• Privileged Identity Management (PIM) and why to use it with Microsoft Defender for Office 365
• Security Control: Privileged access